This section is intended to provide a background or context to the invention that is recited in the claims. The description herein may include concepts that could be pursued, but are not necessarily ones that have been previously conceived, implemented or described. Therefore, unless otherwise indicated herein, what is described in this section is not prior art to the description and claims in this application and is not admitted to be prior art by inclusion in this section.
The following abbreviations that may be found in the specification and/or the drawing figures are defined as follows:    AAA authentication authorization accounting    AKA authentication and key agreement    AUTN authentication token    AV Authentication Vector    AVP attribute-value-pair in diameter messages    BSF bootstrapping server function    CK confidential key    GAA generic authentication architecture    GBA generic bootstrapping architecture    GPL generic push layer    GSID GAA service identifier    GUSS GBA user security settings    HLR home location register    HSS home subscriber server    IK integrity key    IMS internet protocol (IP) multimedia subsystem    LDAP lightweight directory access protocol    NAF network application function (service)    NDS network domain security    RAND random challenge    SLF subscriber locator function    TLS transport layer security    UE user terminal with smart card    UICC universal integrated circuit card    USS user security settings    Ua UE-NAF interface for GAA applications    Ub UE-BSF interface for bootstrapping    XRES expected response in authentication    Zh BSF-HSS interface for bootstrapping procedure    Zh′ BSF-HLR interface for bootstrapping procedure    Zn BSF-NAF interface for GAA applications    Zpn NAF-BSF interface for GAA applicationsReference can be made to the following two publications:
3GPP TS 29.109 V9.0.0 (2009-09) Technical Specification 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Generic Authentication Architecture (GAA); Zh and Zn Interfaces based on the Diameter protocol; Stage 3 (Release 9); and
3GPP TS 33.224 V9.0.0 (2009-09) Technical Specification 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) Push Layer (Release 9).
In mobile devices the use of the GBA enables authentication of a user or subscriber. The use of GBA assumes that the user has a valid identity on a HLR or a HSS. The user authentication is instantiated by a shared secret, for mobile networks one in a smart card in the mobile device and the other in the HLR/HSS. In different network architectures e.g. fixed networks, the shared secret might be stored in a trusted module (e.g. trusted chip on PC) and in the network in a AAA server. GBA authenticates the user by having a network component challenge the smart card and then verifying that the answer to the challenge is similar to one predicted by the HLR/HSS using the AKA protocol. The BSF establishes an additional credential (so called Ks). From this credential it derives service provider specific shared keys between the authenticating entity and the service provider. In operation the secret in the smart card is used to authenticate to the network. Then the BSF derives a master secret and from this the service-specific keys. The terminal is deriving the same keys. Each service thus has different keys (if one is compromised only one service is affected). The service specific shared secret is limited in time and for a specific service domain (called Ks_(ext/int)_NAF). The SLF is a function that informs the BSF on which HSS to find subscriber data, in a case where the network operator has several HSS.
One problem that exists at present in the GBA relates to a situation that arises when a service (NAF) wants to establish a security association with the authenticating entity in the UE, in particular a smart card. For this to occur the NAF needs to know that the security features are supported for the establishment of the security association. Currently the service providing NAF has no means to obtain this information from the terminal or from the network. It can be noted that the NAF may reside outside the operator network and, as a result, will not have a direct interface to the HSS.